You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
"html": "The data model supports two types of extensibility.",
9
+
"rationale": "for",
10
+
"steps": [
11
+
{
12
+
"html": "For maximum interoperability, it is <em class=\"rfc2119\">RECOMMENDED</em> that extensions use the\n<abbr title=\"World Wide Web Consortium\">W3C</abbr> DID Specification Registries mechanism [<cite><a class=\"bibref\" data-link-type=\"biblio\" href=\"https://www.w3.org/TR/did-1.1/#bib-did-spec-registries\" title=\"Decentralized Identifier Extensions\">DID-SPEC-REGISTRIES</a></cite>]. The use of\nthis mechanism for new properties or other extensions is the only specified\nmechanism that ensures that two different <a href=\"https://www.w3.org/TR/did-1.1/#dfn-representations\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-representations-8\">representations</a> will be able to\nwork together."
13
+
},
14
+
{
15
+
"html": "<a href=\"https://www.w3.org/TR/did-1.1/#dfn-representations\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-representations-9\">Representations</a> <em class=\"rfc2119\">MAY</em> define other extensibility mechanisms, including ones\nthat do not require the use of the DID Specification Registries. Such extension\nmechanisms <em class=\"rfc2119\">SHOULD</em> support lossless conversion into any other conformant\n<a href=\"https://www.w3.org/TR/did-1.1/#dfn-representations\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-representations-10\">representation</a>. Extension mechanisms for a <a href=\"https://www.w3.org/TR/did-1.1/#dfn-representations\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-representations-11\">representation</a> <em class=\"rfc2119\">SHOULD</em>\ndefine a mapping of all properties and <a href=\"https://www.w3.org/TR/did-1.1/#dfn-representations\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-representations-12\">representation</a> syntax into the <a href=\"https://www.w3.org/TR/did-1.1/#data-model\">data model</a> and its type system."
16
+
}
17
+
]
18
+
},
19
+
{
20
+
"html": "The requirements for all <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-53\">DID method</a> specifications when defining the\nmethod operations are as follows:",
21
+
"rationale": "resolve",
22
+
"steps": [
23
+
{
24
+
"html": "A <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-54\">DID method</a> specification <em class=\"rfc2119\">MUST</em> define how authorization is performed to\nexecute all operations, including any necessary cryptographic processes."
25
+
},
26
+
{
27
+
"html": "A <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-55\">DID method</a> specification <em class=\"rfc2119\">MUST</em> specify how a <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-controllers\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-controllers-19\">DID controller</a>\ncreates a <a href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-decentralized-identifiers-76\">DID</a> and its associated <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-documents\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-documents-121\">DID document</a>."
28
+
},
29
+
{
30
+
"html": "A <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-56\">DID method</a> specification <em class=\"rfc2119\">MUST</em> specify how a <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-resolvers\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-resolvers-7\">DID resolver</a> uses a\n<a href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-decentralized-identifiers-77\">DID</a> to resolve a <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-documents\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-documents-122\">DID document</a>, including how the <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-resolvers\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-resolvers-8\">DID\nresolver</a> can verify the authenticity of the response."
31
+
},
32
+
{
33
+
"html": "A <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-57\">DID method</a> specification <em class=\"rfc2119\">MUST</em> specify what constitutes an update to a\n<a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-documents\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-documents-123\">DID document</a> and how a <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-controllers\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-controllers-20\">DID controller</a> can update a <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-documents\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-documents-124\">DID\ndocument</a> <em>or</em> state that updates are not possible."
34
+
},
35
+
{
36
+
"html": "The <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-58\">DID method</a> specification <em class=\"rfc2119\">MUST</em> specify how a <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-controllers\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-controllers-21\">DID controller</a> can\ndeactivate a <a href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-decentralized-identifiers-78\">DID</a> <em>or</em> state that deactivation is not possible."
37
+
}
38
+
]
39
+
},
40
+
{
41
+
"html": "The requirements for all <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-61\">DID method</a> specifications when authoring the\n<em>Security Considerations</em> section are as follows:",
42
+
"rationale": "if",
43
+
"steps": [
44
+
{
45
+
"html": "A <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-62\">DID method</a> specifications <em class=\"rfc2119\">MUST</em> follow all guidelines and normative\nlanguage provided in <a href=\"https://www.rfc-editor.org/rfc/rfc3552#section-5\">RFC3552: Writing Security\nConsiderations Sections</a> for the <a href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-decentralized-identifiers-79\">DID</a> operations defined in the <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-63\">DID\nmethod</a> specification."
46
+
},
47
+
{
48
+
"html": "The Security Considerations section <em class=\"rfc2119\">MUST</em> document the following forms of attack\nfor the <a href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-decentralized-identifiers-80\">DID</a> operations defined in the <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-64\">DID method</a> specification:\neavesdropping, replay, message insertion, deletion, modification, denial of\nservice, <a href=\"https://www.w3.org/TR/did-1.1/#dfn-amplification\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-amplification-1\">amplification</a>, and man-in-the-middle. Other known\nforms of attack <em class=\"rfc2119\">SHOULD</em> also be documented."
49
+
},
50
+
{
51
+
"html": "The Security Considerations section <em class=\"rfc2119\">MUST</em> discuss residual risks, such as the\nrisks from compromise in a related protocol, incorrect implementation, or cipher\nafter threat mitigation was deployed."
52
+
},
53
+
{
54
+
"html": "The Security Considerations section <em class=\"rfc2119\">MUST</em> provide integrity protection and update\nauthentication for all operations required by Section <a href=\"https://www.w3.org/TR/did-1.1/#method-operations\" class=\"sec-ref\"><bdi class=\"secno\">7.2 </bdi>Method Operations</a>."
55
+
},
56
+
{
57
+
"html": "If authentication is involved, particularly user-host authentication, the\nsecurity characteristics of the authentication method <em class=\"rfc2119\">MUST</em> be clearly\ndocumented."
58
+
},
59
+
{
60
+
"html": "The Security Considerations section <em class=\"rfc2119\">MUST</em> discuss the policy mechanism by which\n<a href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-decentralized-identifiers-81\">DIDs</a> are proven to be uniquely assigned."
61
+
},
62
+
{
63
+
"html": "Method-specific endpoint authentication <em class=\"rfc2119\">MUST</em> be discussed. Where <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-65\">DID\nmethods</a> make use of <a href=\"https://www.w3.org/TR/did-1.1/#dfn-distributed-ledger-technology\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-distributed-ledger-technology-3\">DLTs</a> with varying network topology, sometimes\noffered as <em>light node</em> or <em>\n<a href=\"https://en.bitcoin.it/wiki/Thin_Client_Security\">thin client</a></em>\nimplementations to reduce required computing resources, the security assumptions\nof the topology available to implementations of the <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-66\">DID method</a> <em class=\"rfc2119\">MUST</em> be\ndiscussed."
64
+
},
65
+
{
66
+
"html": "If a protocol incorporates cryptographic protection mechanisms, the <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-67\">DID\nmethod</a> specification <em class=\"rfc2119\">MUST</em> clearly indicate which portions of the data are\nprotected and by what protections, and it <em class=\"rfc2119\">SHOULD</em> give an indication of the\nsorts of attacks to which the cryptographic protection is susceptible. Some\nexamples are integrity only, confidentiality, and endpoint authentication."
67
+
},
68
+
{
69
+
"html": "Data which is to be held secret (keying material, random seeds, and so on)\n<em class=\"rfc2119\">SHOULD</em> be clearly labeled."
70
+
},
71
+
{
72
+
"html": "<a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-68\">DID method</a> specifications <em class=\"rfc2119\">SHOULD</em> explain and specify the implementation\nof signatures on <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-documents\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-documents-127\">DID documents</a>, if applicable."
73
+
},
74
+
{
75
+
"html": "Where <a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-69\">DID methods</a> use peer-to-peer computing resources, such as with all\nknown <a href=\"https://www.w3.org/TR/did-1.1/#dfn-distributed-ledger-technology\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-distributed-ledger-technology-4\">DLTs</a>, the expected burdens of those resources <em class=\"rfc2119\">SHOULD</em> be discussed\nin relation to denial of service."
76
+
},
77
+
{
78
+
"html": "<a href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-did-methods-70\">DID methods</a> that introduce new authentication <a href=\"https://www.w3.org/TR/did-1.1/#dfn-service\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-service-20\">service</a>\ntypes, as described in <a href=\"https://www.w3.org/TR/did-1.1/#services\" class=\"sec-ref\"><bdi class=\"secno\">5.4 </bdi>Services</a>, <em class=\"rfc2119\">SHOULD</em> consider the\nsecurity requirements of the supported authentication protocol."
"html": "For <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-property-shapes\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-property-shapes-15\">property shapes</a> with a <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-values\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-values-57\">value</a> for <code>sh:path</code> <code>p</code> the\n\t\t\t\t\t\tset of <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-value-node\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-value-node-4\">value nodes</a> is produced by the following steps:",
9
+
"rationale": "add",
10
+
"steps": [
11
+
{
12
+
"html": "Add all <a data-link-type=\"dfn\" href=\"https://www.w3.org/TR/rdf12-concepts/#dfn-node\">nodes</a> in the <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-data-graphs\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-data-graphs-21\">data graph</a> that can be reached from the <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-focus-node\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-focus-node-22\">focus node</a> with the <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-path-mapping\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-path-mapping-2\">path mapping</a> of <code>p</code>."
13
+
},
14
+
{
15
+
"html": "If <code>e</code> is the <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-values\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-values-58\">value</a> of <code>sh:values</code> at the <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-property-shapes\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-property-shapes-16\">property shape</a>,\n\t\t\t\t\t\t\tthen add the <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-output-nodes\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-output-nodes-4\">output nodes</a> of <code>eval(e, <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-data-graphs\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-data-graphs-22\">data graph</a>, scope)</code> where <code>scope</code>\n\t\t\t\t\t\t\tcontains the <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-focus-node\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-focus-node-23\">focus node</a> as the value of the variable <code>focusNode</code>."
16
+
},
17
+
{
18
+
"html": "If the set is still empty and <code>d</code> is the <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-values\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-values-59\">value</a> of <code>sh:defaultValue</code> at the <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-property-shapes\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-property-shapes-17\">property shape</a>,\n\t\t\t\t\t\t\tthen add the <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-output-nodes\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-output-nodes-5\">output nodes</a> of <code>eval(d, <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-data-graphs\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-data-graphs-23\">data graph</a>, scope)</code> where <code>scope</code>\n\t\t\t\t\t\t\tcontains the <a href=\"https://www.w3.org/TR/shacl12-core/#dfn-focus-node\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-focus-node-24\">focus node</a> as the value of the variable <code>focusNode</code>."
"html": "The binding for the variable <code>path</code>, if that is a <a data-link-type=\"dfn\" href=\"https://www.w3.org/TR/rdf12-concepts/#dfn-iri\">IRI</a>"
12
+
},
13
+
{
14
+
"html": "For results produced by a <a data-link-type=\"dfn\" href=\"https://www.w3.org/TR/shacl12-core/#dfn-property-shape\">property shape</a>, a <a data-link-type=\"dfn\" href=\"https://www.w3.org/TR/shacl12-core/#dfn-shacl-property-path\">SHACL property path</a> that is equivalent to the <a data-link-type=\"dfn\" href=\"https://www.w3.org/TR/shacl12-core/#dfn-value\">value</a> of <code>sh:path</code> of the shape"
15
+
}
16
+
]
17
+
},
18
+
{
19
+
"rationale": "for",
20
+
"steps": [
21
+
{
22
+
"html": "The binding for the variable <code>message</code>"
23
+
},
24
+
{
25
+
"html": "For SPARQL-based constraints: The values of <code>sh:message</code> of the <a href=\"https://www.w3.org/TR/shacl12-sparql/#dfn-sparql-based-constraint\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-sparql-based-constraint-12\">SPARQL-based constraint</a>.\n\t\t\t\t\t\t\t\t\t\tFor SPARQL-based constraint components: The values of <code>sh:message</code> of the <a data-link-type=\"dfn\" href=\"https://www.w3.org/TR/shacl12-core/#dfn-validators\">validator</a> of the <a href=\"https://www.w3.org/TR/shacl12-sparql/#dfn-sparql-based-constraint-components\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-sparql-based-constraint-components-2\">SPARQL-based constraint component</a>."
26
+
},
27
+
{
28
+
"html": "For SPARQL-based constraint components: The values of <code>sh:message</code> of the <a href=\"https://www.w3.org/TR/shacl12-sparql/#dfn-sparql-based-constraint-components\" class=\"internalDFN\" data-link-type=\"dfn\" id=\"ref-for-dfn-sparql-based-constraint-components-3\">SPARQL-based constraint component</a>."
29
+
}
30
+
]
31
+
},
32
+
{
33
+
"html": "For every supported shape type (i.e., <a data-link-type=\"dfn\" href=\"https://www.w3.org/TR/shacl12-core/#dfn-property-shape\">property shape</a> or <a data-link-type=\"dfn\" href=\"https://www.w3.org/TR/shacl12-core/#dfn-node-shape\">node shape</a>)\n\t\t\t\t\t\tthe constraint component declares a suitable <a data-link-type=\"dfn\" href=\"https://www.w3.org/TR/shacl12-core/#dfn-validators\">validator</a>.\n\t\t\t\t\t\tFor a given constraint, a validator is selected from the constraint component using the following rules, in order:",
34
+
"rationale": "for",
35
+
"steps": [
36
+
{
37
+
"html": "For <a data-link-type=\"dfn\" href=\"https://www.w3.org/TR/shacl12-core/#dfn-node-shape\">node shapes</a>, use one of the values of <code>sh:nodeValidator</code>, if present."
38
+
},
39
+
{
40
+
"html": "For <a data-link-type=\"dfn\" href=\"https://www.w3.org/TR/shacl12-core/#dfn-property-shape\">property shapes</a>, use one of the values of <code>sh:propertyValidator</code>, if present."
41
+
},
42
+
{
43
+
"html": "Otherwise, use one of the values of <code>sh:validator</code>."
0 commit comments